fix: reliable, self-healing AI feature-bundle installs (#472)

Make on-demand AI feature-bundle installs reliable and self-healing, closing
the failure modes behind most "some tool doesn't work" reports.

Multi-bundle installs: tools needing more than one bundle (Passport Photo,
Enhance Faces) install every required bundle from one action and stay
not-installed until all are present. Verified across all 19 AI tools.

Downloads: self-heal the accelerated Hugging Face (Xet) client so an upgraded
venv no longer silently falls back to slow urllib; restart instead of
corrupting a resumed partial when a proxy ignores Range and returns 200;
verify the completed size; fail fast on disk-full and HTTP 4xx; retry
transient errors five times; add hf_transfer fallback and document Xet egress.

Install integrity: crash-atomic venv writes so a killed or out-of-space
install can no longer tear the shared venv and break other tools; a boot
breadcrumb reseeds a torn venv to a clean state automatically; a post-install
smoke import test refuses to record a bundle whose libraries cannot load; an
install watchdog stops a wedged installer that would otherwise hold the venv
writer lock forever.

Adds unit and end-to-end tests for every failure mode above.

tests/unit/ai/feature-gate.test.ts

@@ -9,15 +9,18 @@ import {
 
 let tempDir: string;
 let savedDataDir: string | undefined;
+let savedCwd: string;
 
 beforeEach(() => {
   savedDataDir = process.env.DATA_DIR;
+  savedCwd = process.cwd();
   tempDir = mkdtempSync(join(tmpdir(), "snapotter-gate-"));
   mkdirSync(join(tempDir, "ai"), { recursive: true });
   process.env.DATA_DIR = tempDir;
 });
 
 afterEach(() => {
+  process.chdir(savedCwd);
   if (savedDataDir === undefined) delete process.env.DATA_DIR;
   else process.env.DATA_DIR = savedDataDir;
   rmSync(tempDir, { recursive: true, force: true });
@@ -73,6 +76,28 @@ describe("missingBundleForScript", () => {
     expect(missingBundleForScript("face_landmarks")).toBe("face-detection");
     expect(missingBundleForScript("remove_bg")).toBeNull();
   });
+
+  it("uses the native ./data fallback when DATA_DIR is unset", () => {
+    delete process.env.DATA_DIR;
+    process.chdir(tempDir);
+    const defaultAiDir = join(tempDir, "data", "ai");
+    mkdirSync(defaultAiDir, { recursive: true });
+    writeFileSync(
+      join(defaultAiDir, "installed.json"),
+      JSON.stringify({
+        bundles: {
+          "object-eraser-colorize": {
+            version: "1.0.0-test",
+            installedAt: "2026-01-01T00:00:00.000Z",
+            models: [],
+          },
+        },
+      }),
+      "utf-8",
+    );
+
+    expect(missingBundleForScript("inpaint.py")).toBeNull();
+  });
 });
 
 describe("SCRIPT_BUNDLE_MAP drift vs dispatcher.py", () => {